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The Program Manager for the Information Sharing Environment (PM-ISE), in consultation 
with the Co-Chairs of the ISE Privacy Guidelines Committee (PGC) and in collaboration 
with the NSI Program Management Office (PMO) within the Department of Justice, has 
prepared and released a report entitled Privacy, Civil Rights, and Civil Liberties Analysis and 
Recommendations for the Nationwide Suspicious Activity Reporting Initiative based upon the 
findings of the NSI Evaluation Environment. 

This Report provides an update to the Initial Privacy and Civil Liberties Analysis released in 
September 2008, and builds upon the commitment to safeguard privacy, civil rights, and 
civil liberties in Evaluation Environment sites. 


THE NSI PRIVACY, CIVIL RIGHTS, AND CIVIL LIBERTIES FRAMEWORK 


The recommendations of the Initial Privacy and Civil Liberties Analysis resulted in the 
development of a comprehensive privacy, civil rights, and civil liberties protection 
framework for the Evaluation Environment, known as the NSI Privacy, Civil Rights, and 
Civil Liberties Framework (“NSI Privacy Framework”). 
The Evaluation Environment sites were required to develop and adopt privacy, civil rights, 
and civil liberties policies that were “at least as comprehensive as the Information Sharing 
Environment (ISE) Privacy Guidelines,” and to implement the following NSI Privacy 
Framework: 

o Designation of a privacy and civil liberties officer; 


o Establishment of business processes for identifying, documenting and sharing ISE- 
SAR information; 


o Adopting and integrating the SAR vetting process established by the ISE-SAR 
Functional Standard (Version 1.0) into existing business processes — this process 
required each SAR to be reviewed by a front-line supervisor prior to submission and 
subsequently by an experienced investigator or analyst trained in counterterrorism 
issues before designation as an ISE-SAR; 


o Provision of standardized training to front-line officers, investigators, analysts, and 
supervisory personnel to: 1) educate such personnel on the vetting process required 
by the ISE-SAR Functional Standard and 2) strengthen the ability of personnel, front 
line officers in particular, to recognize behaviors potentially indicative of 
preoperational planning related to terrorism, and to avoid racial and religious 
profiling; and 
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o Outreach to the community and privacy, civil rights, and civil liberties groups to 
foster transparency and trust and to obtain their feedback and perspective on 
information sharing initiatives. 


HIGHLIGHTS AND OBSERVATIONS 

e The Evaluation Environment validated the critical role of the NSI Privacy Framework in 
establishing a common protective structure within which to conduct information sharing 
operations, enabling sites to fulfill the dual mandates of maximizing information sharing 
while protecting privacy, civil rights, and civil liberties. 

e Evaluation Environment sites neither experienced reported breaches of personal 
information associated with ISE-SAR information nor received complaints for redress. 

e The Evaluation Environment resulted in significant implementation progress, while 
revealing areas requiring attention during the nationwide implementation of the NSI in 
2010. 


RECOMMENDATIONS FOR NSI IMPLEMENTATION 
e To ensure that the elements of the NSI Privacy Framework is adopted, properly 
implemented, and continuously assessed as the nationwide implementation of the NSI 
continues, the Report includes the following recommendations: 
o The NSI Privacy Framework, including the enhanced protections established in the 
May 21, 2009 revision of the ISE-SAR Functional Standard (Version 1.5), must be 
adopted and implemented as a condition of participation in the NSI, with careful 
consideration of the resources necessary for full implementation; 


o NSI participants must adhere to the standardized vetting process and consistently 
use the current ISE-SAR Functional Standard criteria in the identification, 
documentation, and sharing of ISE-SAR information to mitigate the risk of profiling 
based solely on race, ethnicity, national origin, or religion, and to improve mission 
effectiveness; 


o Participating organizations must designate and train a privacy and civil liberties 
officer who has access to the services of legal counsel, if the officer is not an attorney; 


o Each participating organization must exercise due diligence in implementing 
appropriate physical, technical, and administrative measures to safeguard 
information; and 


o Each participating organization must emphasize and establish procedures to ensure 
personal responsibility and accountability for protecting privacy, civil rights, and 
civil liberties. 


e Federal, state, local, tribal, and private sector partners, as appropriate, must continue to 
work together — in consultation with the privacy, civil rights, and civil liberties advocacy 
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community — to ensure that the elements of the NSI Privacy Framework are adopted, 
properly implemented, and continuously assessed. 


BACKGROUND 

e The Nationwide Suspicious Activity Reporting (SAR) Initiative (NSI) is an outgrowth of a 
number of separate but related activities over the last several years that respond directly to 
the mandate to establish a unified process for reporting, tracking, and accessing SAR 
information in a manner that rigorously protects the privacy, civil rights, and civil liberties 
of Americans. 

e Federal partners, including the Program Manager for the Information Sharing Environment 
(PM-ISE) and the Department of Justice’s Bureau of Justice Assistance, conducted an 
eighteen month Evaluation Environment Initiative to assess the implementation of the SAR 
process by twelve initial sites. 


